detection.wiki

Detection rules › Sublime MQL

Attachment: Encrypted ZIP containing VHDX file

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects ZIP attachments that are encrypted and contain VHDX files, which may be used to bypass security controls or deliver malicious payloads.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesMalware/Ransomware
Tactics and techniquesEncryption, Evasion

Event coverage

Message attribute
attachments (collection)
type

Rule body MQL

type.inbound
and any(filter(attachments, .file_type == "zip"),
        any(file.explode(.),
            .scan.zip.encrypted == true
            and any(.scan.zip.all_paths, strings.ends_with(., "vhdx"))
        )
)

Detection logic

Scope: inbound message.

Detects ZIP attachments that are encrypted and contain VHDX files, which may be used to bypass security controls or deliver malicious payloads.

  1. inbound message
  2. any of filter(attachments) where:
    • any of file.explode(.) where all hold:
      • .scan.zip.encrypted is True
      • any of .scan.zip.all_paths where:
        • . ends with 'vhdx'

Inspects: attachments[].file_type, type.inbound. Sensors: file.explode, strings.ends_with.

Indicators matched (2)

FieldMatchValue
attachments[].file_typeequalszip
strings.ends_withsuffixvhdx